sanitize-html 2.17.6 → 2.17.7

package/README.md

@@ -696,6 +696,19 @@ And you can forbid the use of protocol-relative URLs (starting with `//`) to acc
 allowProtocolRelative: false
 ```
 
+### SVG animations of URL attributes are discarded
+
+For security reasons, if your `allowedTags` includes the SVG animation elements (`animate`, `animateColor`, `animateMotion`, `animateTransform` and `set`), note that an animation which targets a URL attribute is always discarded:
+
+```html
+<!-- Discarded: this would set the link's href to javascript: after sanitization -->
+<animate attributeName="href" values="#safe;javascript:alert(1)" dur=".01s" fill="freeze">
+```
+
+An animation element carries no URL itself. It names the attribute it animates with `attributeName` and supplies the new value in `values`, `from`, `to` or `by`, which the browser copies into the target attribute after sanitization. Scheme checking those values is not sufficient, because `values` is a semicolon-separated *list* of destinations, so we discard the animation instead whenever `attributeName` selects `href`, `xlink:href` or any other attribute listed in `allowedSchemesAppliedToAttributes`.
+
+Animations of attributes that are not URLs, such as `fill` or `opacity`, are unaffected.
+
 ### Discarding the entire contents of a disallowed tag
 
 Normally, with a few exceptions, if a tag is not allowed, all of the text within it is preserved, and so are any allowed tags within it.

package/index.js

@@ -12,6 +12,17 @@ const mediaTags = [
 ];
 // Tags that are inherently vulnerable to being used in XSS attacks.
 const vulnerableTags = [ 'script', 'style' ];
+// SVG SMIL animation elements. These do not carry a URL themselves: they
+// retarget an attribute of another element, naming it with `attributeName`
+// and supplying the new value(s) in `values`, `from`, `to` and `by`.
+const svgAnimationTags = [
+  'animate', 'animatecolor', 'animatemotion', 'animatetransform', 'set'
+];
+// Attribute names that always name a URL sink, whatever
+// `allowedSchemesAppliedToAttributes` has been narrowed to. A namespace prefix
+// is ignored when matching, so `xlink:href` and any other prefixed spelling of
+// `href` are covered.
+const alwaysUrlAttributes = [ 'href' ];
 
 function each(obj, cb) {
   if (obj) {
@@ -272,7 +283,7 @@ function sanitizeHtml(html, options, _recursing) {
         }
       }
 
-      if (!tagAllowed(name) || (options.disallowedTagsMode === 'recursiveEscape' && !isEmptyObject(skipMap)) || (options.nestingLimit != null && depth >= options.nestingLimit)) {
+      if (!tagAllowed(name) || animatesUrlAttribute(name, attribs) || (options.disallowedTagsMode === 'recursiveEscape' && !isEmptyObject(skipMap)) || (options.nestingLimit != null && depth >= options.nestingLimit)) {
         skip = true;
         skipMap[depth] = true;
         if (options.disallowedTagsMode === 'discard' || options.disallowedTagsMode === 'completelyDiscard') {
@@ -773,6 +784,39 @@ function sanitizeHtml(html, options, _recursing) {
     });
   }
 
+  // True if this is an SVG SMIL animation element that animates a URL-bearing
+  // attribute, e.g. `<animate attributeName="href" values="#safe;javascript:...">`.
+  //
+  // Such an element carries no URL of its own: the browser copies the animation
+  // values into the target attribute *after* sanitization, so a `javascript:`
+  // destination reaches a live link sink without ever being scheme checked.
+  // `values` compounds this, because it is a semicolon-separated LIST of
+  // destinations: checking it as one flat URL only validates its first entry, so
+  // a leading `#safe` fragment carries the rest of the list past the policy.
+  //
+  // Re-checking each entry of each value attribute would leave the safety of the
+  // output resting on our imitation of SMIL list parsing, so we reject the
+  // animation on the strength of its target instead. Animations of attributes
+  // that are not URL sinks, such as `fill` or `opacity`, are unaffected.
+  function animatesUrlAttribute(name, attribs) {
+    if (svgAnimationTags.indexOf(name.toLowerCase()) === -1) {
+      return false;
+    }
+    const schemeCheckedAttributes = options.allowedSchemesAppliedToAttributes || [];
+    return Object.keys(attribs || {}).some(function(attributeName) {
+      if (attributeName.toLowerCase() !== 'attributename') {
+        return false;
+      }
+      const target = (attribs[attributeName] || '').trim().toLowerCase();
+      // The target may be namespace prefixed (`xlink:href`). Which prefixes are
+      // in scope depends on the document, so consider the local name too.
+      const localName = target.slice(target.lastIndexOf(':') + 1);
+      return alwaysUrlAttributes.indexOf(localName) !== -1 ||
+        schemeCheckedAttributes.indexOf(target) !== -1 ||
+        schemeCheckedAttributes.indexOf(localName) !== -1;
+    });
+  }
+
   function parseUrl(value) {
     value = value.replace(/^(\w+:)?\s*[\\/]\s*[\\/]/, '$1//');
     if (value.startsWith('relative:')) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sanitize-html",
-  "version": "2.17.6",
+  "version": "2.17.7",
   "description": "Clean up user-submitted HTML, preserving allowlisted elements and allowlisted attributes on a per-element basis",
   "sideEffects": false,
   "main": "index.js",